Wargame · Applied Linux CTF
Skip to levels
Play in the browser
Boot the arena right here — a real Linux shell, client-side,<br>nothing to install. All nine levels are planted on this box the moment<br>it boots; you land as player. Find each flag with the skill<br>it trains, then paste it into the matching level below.
the arena — nine levels, one browser shell<br>boot the arena ▸
idle
Runs via v86,<br>entirely client-side. Practice mode: because the box runs<br>in your tab, the flags are planted locally — a determined reader can<br>dig them out of the page source. The live boxes are<br>the cheat-resistant, graded version. Covers levels 00–08 only —<br>09–18 have no browser practice mode, see below.
Attack the live boxes
Each level is its own Nanos unikernel — a single-app<br>machine with no shell, no users, exposing one service over TCP. Talk to it<br>with nc, solve what it asks, and it hands you the flag.
$ nc unik.cx 13370 # level 0<br>$ nc unik.cx 1337N # level N → port 13370+N<br>One unikernel per level on unik.cx, ports<br>13370–13378. Each flag you pry loose unlocks<br>the next rung below; progress is kept in this browser only.
Levels 09–18: the hard track
A second, unrelated backend: each of these boxes is a full Linux guest<br>kernel in its own Firecracker microVM , not a unikernel<br>— real users, real processes, a root-owned watcher doing something<br>exploitable in the background. No SUID binaries work here on purpose;<br>every box enforces no_new_privs, so the bug is always logic,<br>never a setuid bit.
$ nc ctf.unik.cx 27295 # play level 09<br>$ echo 'AL{...}' | nc ctf.unik.cx 37295 # submit level 09's flag<br>Two ports per level: one to play<br>(connect and explore), a separate one to submit the flag<br>you find — submission is checked server-side against a stored<br>SHA-256 digest and never touches the play session. The level board below<br>still keeps a personal checklist in this browser the same way it does for<br>00–08; submitting on the real port is the graded, cheat-resistant<br>proof of solve.
LevelPlay portSubmit port
092729537295<br>102425134251<br>112646236462<br>122757537575<br>132082430824<br>142129231292<br>152133831338<br>162949239492<br>172091830918<br>182775137751
level 00<br>Foothold
50 pts
reinforces · Logging In
Connect to the level-0 box. It hands you the flag just for showing up — get comfortable with nc.
ncconnect
submit
level 01<br>Hidden in plain sight
75 pts
reinforces · Learning the Terminal
The box prints a noticeboard. One line is the flag, only encoded — read it, decode it.
ncbase64 -d
submit
level 02<br>Needle, meet haystack
100 pts
reinforces · Learning the Terminal
The box streams thousands of lines; exactly one carries the token. Filter the stream, don't scroll it.
ncgreppipes
submit
level 03<br>Permission denied
125 pts
reinforces · Security Configuration
The box guards the flag behind a pass-word. Read the prompt and send the right word back.
ncstdinprotocols
submit
level 04<br>In the logs
150 pts
reinforces · Storage, Monitoring, and Troubleshooting
Ask the box for its logs, then dig the token out of the noise it dumps.
nccommandsgrep
submit
level 05<br>Cron and on
175 pts
reinforces · Automation
The box flashes a token once, on a timer. Stay connected and catch it as it goes by.
ncstreamspatience
submit
level 06<br>Listening
200 pts
reinforces · Network Configuration
The box poses a challenge and wants the answer before it yields the flag. Parse it, compute, reply.
ncparserespond
submit
level 07<br>Mounted
225 pts
reinforces · Storage, Monitoring, and Troubleshooting
The box has an undocumented command its help won't list. Enumerate until it gives.
ncenumeration
submit
level 08<br>The vault
300 pts
reinforces · Everything
The flag is split across two of the box's commands. Pull both halves and combine them.
ncsynthesis
submit
level 09<br>Trusted by name
250 pts
reinforces · Security Configuration · hard track, ctf.unik.cx
A root-owned watcher runs a helper program by name only, never a full path. If you control where it looks first, you control what it runs.
PATHexecvetrust
submit
level 10<br>Echo chamber
275 pts
reinforces · Security Configuration · hard track, ctf.unik.cx
A root-owned watcher builds a shell command out of a value you get to set. It never checks what's inside it before running it.
shell injectionquoting
submit
level 11<br>Borrowed script
300 pts
reinforces · Security Configuration · hard track, ctf.unik.cx
A root process runs a script on a timer. Nothing stops you from rewriting that script before it runs again.
file permissionsrace
submit
level 12<br>Old sessions
175 pts
reinforces · Learning the Terminal · hard track, ctf.unik.cx
Somebody worked here before you. Their shell still remembers what they typed — including where they put things.
historyfind
submit
level 13<br>One line in ten thousand
200 pts
reinforces · Storage, Monitoring, and Troubleshooting...